# Australia requires government entities to meet a model that calls for automated asset discovery and daily scanning of internet-facing network devices

Page: https://flyvolo.ai/en/changes/ev-20231127-network-engineer-11
Date: 2023-11-27 · Stage: Policy mandate
Can this record move a task judgement? only together with another independent record
Occupation: https://flyvolo.ai/en/careers/network-engineer

## Scope

Australia, Commonwealth entities. The maturity model's requirements include that an automated method of asset discovery is used at least fortnightly and that a vulnerability scanner is used at least daily to find missing patches for internet-facing servers and network devices. ASD's report on the Commonwealth's 2025 posture says that since 1 July 2022 the protective security policy framework requires entities to implement the model to Maturity Level Two, and that 22% reached it in 2025. It requires automated detection, not automated patching; uptake is low.

## Source

- Australian Signals Directorate — Essential Eight maturity model (published 30 June 2017, last reviewed 27 November 2023); required to Maturity Level Two for Commonwealth entities by PSPF Policy 14 since 1 July 2022 — https://www.cyber.gov.au/publication/essential-eight-maturity-model (primary source)

## What this means

In Australia's federal government, finding devices and missing patches is required to be automated, though most entities do not yet meet the level.

## What it does not show yet

A requirement that most entities have not met; it does not cover automated patching or measure staff time.

## How to verify it yourself

Open ASD's Essential Eight maturity model and find "An automated method of asset discovery is used at least fortnightly".


More: https://flyvolo.ai/llms.txt